An upgraded version of the ToxicPanda Android malware now targets 349 financial institutions spanning 16 countries, up from just 16 banking apps in its previous iteration, according to a Wednesday report from Zimperium zLabs. The malware, also known as TgToxic and active in the wild since at least July 2022, features significant enhancements including 167 remote commands and a PIN harvesting workflow that targets more than 140 banking and cryptocurrency applications. The update represents a dramatic expansion in both targeting scope and technical capabilities, researchers say.
The new version exploits Android's accessibility service to steal every on-screen UI element and uses an overlay-based credential theft mechanism to compromise users of banking and crypto apps globally, the report notes. ToxicPanda 2.0 has fleshed out previously unimplemented commands, siphons lock screen credentials through fake overlays, and introduces an automated click-based mechanism that abuses Android Wireless Debugging via Android Debug Bridge (ADB) to enable privilege escalation and shell-level access on infected devices. The malware achieves this by leveraging accessibility services to activate Developer Options and turn on Wireless debugging. Distribution methods have also shifted, with samples now delivered through Amazon AWS-hosted buckets, indicating attackers are using cloud infrastructure for malware delivery.
"By abusing the Android accessibility service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions [across 16 countries]," security researcher Vishnu Pratapagiri said. The malware establishes a command-and-control connection by sending an initial HTTPS request to create a bidirectional WebSocket communication channel for receiving commands and exchanging data. Like the recently discovered Manic malware, ToxicPanda can display full-screen "system update" overlays to hide its background activities and deploy an invisible transparent overlay to capture touch inputs and harvest PIN codes. Additional functionalities include prompts that deceive victims into granting Device Administrator privileges, overwriting the device's local lock screen PIN or password with an attacker-controlled value, and profiling infected devices to determine the OEM vendor and take steps to exempt the malware from battery optimization policies using accessibility services.
The report's findings come alongside a new GoldDigger campaign that primarily impersonates airline companies and shopping retailers, causing what researchers describe as a "massive infection" in South Africa and the U.K. GoldDigger, first documented by Group-IB in October 2023 and attributed to Chinese-speaking threat actor GoldFactory, uses a sophisticated packer called "dpt-shell" to obfuscate its code and evade analysis. According to IBM Trusteer, the malware can inject input to banking apps to mimic user interaction such as entering text, clicking buttons, and performing gestures, enabling it to initiate fraudulent transactions from victims' banking apps to attackers. It also provides operators with real-time screen access, captures credentials through fake overlays, and runs targeted apps in a virtual environment for full visibility into runtime behavior and real-time interception of sensitive data.
To defend against these threats, the report recommends reviewing installed applications and removing any unfamiliar ones, auditing app permissions before granting them, downloading apps only from trusted sources, keeping devices current with updates, enabling two-factor authentication for all online accounts, and monitoring bank accounts for unusual transactions. Both malware families exploit fundamental weaknesses in Android's accessibility service framework, which was designed to help users with disabilities but has become a primary attack vector for banking trojans. The convergence of cloud-based distribution, advanced evasion techniques, and global targeting signals an escalating threat landscape for mobile banking security. Organizations managing device fleets or supporting bring-your-own-device policies face mounting pressure to balance user autonomy with enterprise security controls, while consumers confront an adversary capable of bypassing traditional app store protections through social engineering and legitimate cloud infrastructure.